Luxion KeyShot EUVD-2026-107407

Exploitation requires the victim to open an attacker-supplied malicious BIP file in Luxion KeyShot (or visit a malicious page that delivers one), and depends on KeyShot resolving and loading a library from an unsecured/attacker-writable location in its search path (CWE-427). Key limiting factors: mandatory user interaction (UI:R) to open the file, a local attack vector (AV:L) rather than network-remote exploitation, and the requirement that the attacker be able to influence the library search path (e.g., co-locate a malicious library alongside the delivered file or in a writable path KeyShot searches). Code executes only with the privileges of the current KeyShot user, and scope is unchanged (S:U).

This is a moderate-priority, user-interaction-gated code execution flaw rather than a mass-exploitation emergency. The CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8 High) is internally consistent with the description: despite the phrase 'remote attackers,' the vector correctly encodes AV:L (local) because exploitation requires the victim to open a malicious BIP file or visit a malicious page that delivers one - the attacker never touches the host directly over a network. The CWE-427 (Uncontrolled Search Path Element) root cause means this is effectively a library/DLL-planting issue where KeyShot loads a library from an unsecured location. No EPSS score, CISA KEV listing, SSVC decision point, or POC was supplied in the input; per precision rules the status is 'no public exploit identified at time of analysis.' There is no signal conflict to flag beyond the common ZDI convention of describing file-parsing bugs as 'remote' while scoring them AV:L - defenders should read this as a local-vector, UI-dependent flaw, not an unauthenticated network RCE. Priority should be driven by how widely KeyShot is deployed in a given environment and whether users routinely open untrusted .bip files; absent active-exploitation evidence, this warrants prompt patching but not crisis handling.

An attacker crafts a malicious BIP scene file (and an accompanying attacker-controlled library placed in the search path) and delivers it via email, a shared project folder, or a malicious web page. When a KeyShot user opens the file, the application loads the planted library from the unsecured location and executes attacker code in the context of the user's KeyShot process. No public exploit code was identified at time of analysis.